github-actions-policy

Private repo Actions policy

For private repositories, GitHub Actions jobs must run on self-hosted runners by default to minimize runner costs (save money).

• Use the repo/org shared selector, for example: ${{ fromJson(vars.SELF_HOSTED_RUNNER_LABELS || '["self-hosted","self-hosted-mikey"]') }}
• Do not use ubuntu-latest or other GitHub-hosted runners in a private repo unless the user explicitly approves a specific exception
• Treat any mixed routing pattern like "PRs on GitHub-hosted, pushes on self-hosted" as a routing decision that requires explicit user approval
• When reviewing or editing private-repo workflows, flag GitHub-hosted runner usage as policy drift unless there is documented approval